3 ms·

Not that this shouldn't be patched and all, but this seems like it is being treated with more urgency that is required. If I am understanding the CVE correctly

Not that this shouldn't be patched and all, but this seems like it is being treated with more urgency that is required. If I am understanding the CVE correctly, you need to be able to launch privileged containers with an attacker-controlled image where the container user is root and not namespaced (i.e., the same root as the outside root user). How is this not "on the wrong side of an airtight hatch[1]"? Am I missing something here? If you can start privileged containers, why not just execute evil.exe directly? [1]: https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=31283 https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=...

tssuser 8y ago
Privileged containers in docker have a different meaning [1]. A lot of work has gone into trying to harden the default docker container options against container escape, even when the process is running as root. This includes dropping some capabilities, blocking syscalls with seccomp, shadowing sensitive procfs and sysfs paths, hiding most devices, and some LSM hardening [2]. Even with all that it is far more effective to just run as non-root, but hopefully that gives some context for why vulnerabilities like this are treated as high severity. [1] https://docs.docker.com/engine/reference/commandline/run/#full-container-capabilities---privileged https://docs.docker.com/engine/reference/commandline/run/#fu... [2] https://docs.docker.com/engine/security/non-events/ https://docs.docker.com/engine/security/non-events/
tinco 8y ago
I run a privileged container, of which I am not the author. I also know many other people run this container in privileged mode. No one is paying that person for it, and if they want to or they get compromised at some point we all might get rooted when we update the image. I think my OS is on a read only filesystem though, and maybe I've got it namespaced correctly as well, but still it's pretty dangerous.
cpuguy83 8y ago
"Privilged" means root in the container maps to root on the host, not literal "--privileged"

tssuser 8y ago

Privileged containers in docker have a different meaning [1]. A lot of work has gone into trying to harden the default docker container options against container escape, even when the process is running as root. This includes dropping some capabilities, blocking syscalls with seccomp, shadowing sensitive procfs and sysfs paths, hiding most devices, and some LSM hardening [2]. Even with all that it is far more effective to just run as non-root, but hopefully that gives some context for why vulnerabilities like this are treated as high severity. [1] https://docs.docker.com/engine/reference/commandline/run/#full-container-capabilities---privileged https://docs.docker.com/engine/reference/commandline/run/#fu... [2] https://docs.docker.com/engine/security/non-events/ https://docs.docker.com/engine/security/non-events/

tinco 8y ago

I run a privileged container, of which I am not the author. I also know many other people run this container in privileged mode. No one is paying that person for it, and if they want to or they get compromised at some point we all might get rooted when we update the image. I think my OS is on a read only filesystem though, and maybe I've got it namespaced correctly as well, but still it's pretty dangerous.

cpuguy83 8y ago

"Privilged" means root in the container maps to root on the host, not literal "--privileged"